Skip to content

fix: Deserialization checks valid class types for HttpTransportFactory#1882

Merged
lqiu96 merged 4 commits intomainfrom
deserialization-check
Feb 4, 2026
Merged

fix: Deserialization checks valid class types for HttpTransportFactory#1882
lqiu96 merged 4 commits intomainfrom
deserialization-check

Conversation

@lqiu96
Copy link
Member

@lqiu96 lqiu96 commented Jan 28, 2026

See b/479228571 for more information.

Attempts to resolve any deserialization issue when trying to create a new HttpTransportFactory. Validates so that a HttpTransportFactory implementation can be created to prevent arbitrary loading of classes (e.g. gadget classes that can execute commands).

Mimics the existing loading behavior in the constructor:

  • Checks the ServiceLoader for any implementation
  • Attempts to use the default
  • Loads any custom implementation and tries to ensure that it's valid and loading doesn't run any static code.

@lqiu96 lqiu96 requested a review from zhumin8 January 28, 2026 20:00
@product-auto-label product-auto-label bot added the size: l Pull request size is large. label Jan 28, 2026
@lqiu96 lqiu96 marked this pull request as ready for review February 2, 2026 16:10
@lqiu96 lqiu96 requested review from a team as code owners February 2, 2026 16:10
@sonarqubecloud
Copy link

sonarqubecloud bot commented Feb 4, 2026

Quality Gate Failed Quality Gate failed

Failed conditions
0.0% Coverage on New Code (required ≥ 80%)

See analysis details on SonarQube Cloud

@lqiu96 lqiu96 added the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Feb 4, 2026
@yoshi-kokoro yoshi-kokoro removed the kokoro:force-run Add this label to force Kokoro to re-run the tests. label Feb 4, 2026
@lqiu96 lqiu96 merged commit 76ff74e into main Feb 4, 2026
27 of 28 checks passed
@lqiu96 lqiu96 deleted the deserialization-check branch February 4, 2026 22:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size: l Pull request size is large.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants